1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 16:01

Target

1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
Size

2.7MB
MD5

d59e9bb6f95ae207a53f23ed26248580
SHA1

00fe8a9e553df61b5ed54eb2408bc846bd739513
SHA256

1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882
SHA512

db02a5393629dde88ff6848a848f0160b13b9dd7b2c5dc580a1d3474cffd0243d263b7a8558a42212791e2d4c3a2ca6a0da911d91742e6a82fb891d47f275296
SSDEEP

49152:p282dv9JzLmV91XzYRGfYJPtqpigqCxRJM:of+t0RGetqplVx

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	1540	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1540	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2496	1540	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe	30
PID 1540 wrote to memory of 2496	1540	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe	30
PID 1540 wrote to memory of 2496	1540	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe	30
PID 1540 wrote to memory of 2496	1540	1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe	30

C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe
"C:\Users\Admin\AppData\Local\Temp\1ddae5bd8f7055944ff867a5d6f0057d620d520e8e317b8cb802ff49822f1882N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 156
  2⤵
  - Program crash
  PID:2496